Passwords and authentication

Ways to authenticate, strong passwords, 2FA, CAPTCHA and hashing.

F11.5Cyber securityGCSE15 min

Authentication is proving you are who you say you are, before a system lets you in. The most common way is a password, but there are others, and a strong password matters more than any of them. This lesson covers ways to authenticate, what makes a password strong, and ends by locking the robot behind one.

Ways to prove who you are

Authentication uses one or more of: something you know, something you have, or something you are.

Two-factor authentication (2FA) uses two of these, so that a stolen password alone is not enough. A CAPTCHA does a different job: it stops automated programs, such as a brute force attack, by asking for something only a person can do easily.

What makes a password strong?

• Long: every extra character multiplies the guesses needed.
• Varied: a mix of lower case, upper case, digits and symbols.
• Not a word or a fact: not password, robot, or your birthday.
• Unique: a different password for each account, so one leak does not open the rest.

A password manager makes long, unique passwords for every site and remembers them, so you do not have to.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

def strength(password):
    score = 0
    if len(password) >= 8: score = score + 1
    if any(c.islower() for c in password): score = score + 1
    if any(c.isupper() for c in password): score = score + 1
    if any(c.isdigit() for c in password): score = score + 1
    if any(not c.isalnum() for c in password): score = score + 1
    return score

for password in ["robot", "Password1", "b7!K2p qW"]:
    print(password, "->", strength(password), "of 5")

Run this in the simulator

Storing passwords safely

A system should never store passwords as plain text: if the file leaks, every password is exposed. Instead it stores a hash, a scrambled version that cannot be turned back. When you log in, it hashes what you typed and compares the hashes. You will use the same idea to lock the robot.

Locking the robot

The robot below only drives when the right password is given, and locks out after three wrong tries, which is what defeats a brute force attack.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

PASSWORD = "bugbot42"
attempts = ["letmein", "bugbot1", "bugbot42"]     # what someone typed, in order
unlocked = False
for tries, attempt in enumerate(attempts, start=1):
    if tries > 3:
        break
    if attempt == PASSWORD:
        unlocked = True
        break
    print("wrong password, try", tries)
if unlocked:
    led(0, 255, 0)
    forward(50, distance=20)
    print("unlocked")
else:
    led(255, 0, 0)
    print("locked out")

Run this in the simulator

Task: a password checker

Write strength(password) scoring one point for each rule met: at least 8 characters; a lower-case letter; an upper-case letter; a digit; a symbol (a character that is not a letter or digit). For each password in passwords, print <password>: <score>/5 <verdict>, where the verdict is weak for 0 to 2, ok for 3, and strong for 4 or 5. At the end print strong passwords: <n>.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

passwords = ["robot", "Sunshine", "Bugbot42", "x9$Lq2!vT", "12345678"]

Challenges

1. Add a rule that a password must not contain the word "robot" or "password".
2. How many guesses is a 6-character lower-case password? Use 26 ** 6.
3. Why does two-factor authentication protect you even if your password leaks?